2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader

General

Target
2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader
Size 272KB
Sample261020-t85cvscd48
SHA256 1272a03fb3b879dc6e1049418aeb0530cea2bf08b354ff07ed553e7dc8c545cc
MD5 70edc2078f0497d35e742bfdce285842
SHA1 8f982382c345648bb5e44cd12cc515052c690f9a
SHA512 9c2a055373ecc4bb51b38f14ee02240ef9e26fafa06f8491062881c4fb67e21905ab85c995b8e6ac0fc8669079ea21e5c1469ca248656ad1a9cde4ecb502b4a5
SSDEEP 3072:OzDL8MlzI1V6s4X7fYldi+1qtvKqzwLMraCSDBE7Y4kGdz94QtgbF6+r5t/eIVGW:Oz/zS6Adi+1qtBMe9dpwA+7Jw8S/8
TLSH
T16D446C26B3D2C0B5FE4315320D9A6B7D96AAD58A0F714FC3A39DE91CDB215C2D432329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader

File Explorer

2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader

.exe 272KB

2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader

IMPHASH cead953729c5d102be8a37523bdc83aa
SHA256 1272a03fb3b879dc6e1049418aeb0530cea2bf08b354ff07ed553e7dc8c545cc
MD5 70edc2078f0497d35e742bfdce285842
SHA1 8f982382c345648bb5e44cd12cc515052c690f9a
SHA512 9c2a055373ecc4bb51b38f14ee02240ef9e26fafa06f8491062881c4fb67e21905ab85c995b8e6ac0fc8669079ea21e5c1469ca248656ad1a9cde4ecb502b4a5
SSDEEP 3072:OzDL8MlzI1V6s4X7fYldi+1qtvKqzwLMraCSDBE7Y4kGdz94QtgbF6+r5t/eIVGW:Oz/zS6Adi+1qtBMe9dpwA+7Jw8S/8
TLSH
T16D446C26B3D2C0B5FE4315320D9A6B7D96AAD58A0F714FC3A39DE91CDB215C2D432329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

158726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Repos\vbdecomp\build\matching\gui-packet-flush-verification\runner.pdb

kernel32

VirtualFree VirtualAlloc InterlockedDecrement InterlockedIncrement WideCharToMultiByte Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA MultiByteToWideChar HeapFree RtlUnwind RaiseException GetModuleHandleA GetCommandLineA GetVersionExA LCMapStringA GetLastError LCMapStringW GetCPInfo FatalAppExitA HeapAlloc HeapReAlloc ExitProcess GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeA GetStringTypeW HeapDestroy HeapCreate IsBadWritePtr TlsFree SetLastError GetCurrentThreadId TlsSetValue TlsGetValue GetCurrentThread TlsAlloc GetProcAddress SetUnhandledExceptionFilter SetConsoleCtrlHandler TerminateProcess GetCurrentProcess HeapSize WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA VirtualProtect GetSystemInfo VirtualQuery GetUserDefaultLCID EnumSystemLocalesA IsValidLocale IsValidCodePage QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsBadReadPtr IsBadCodePtr FlushFileBuffers SetFilePointer CloseHandle GetTimeZoneInformation GetACP GetOEMCP LoadLibraryA GetLocaleInfoW SetStdHandle ReadFile SetEnvironmentVariableA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_70edc2078f0497d35e742bfdce285842_amadey_elex_smoke-loader

kernel32

generic